Abstract: A method and apparatus are provided for network security based on a security status of a device. A security update status of a device is evaluated; and one or more of a plurality of security policies are selected to apply to the device based on the security update status. The available security philosophies may include, for example, a “protect the good” philosophy, an “encourage the busy” philosophy and a “shut off the non-compliant” philosophy. The security update status can evaluate, for example, a version level of one or more security features installed on the device or can be based on a flag indicating whether the device satisfies predefined criteria for maintaining one or more computer security protection features up-to-date.

Abstract: A system for providing two-way Web services is disclosed that enables the client and server to be in different enterprise domains—behind firewalls—with few or no changes to the firewalls. In accordance with the illustrative embodiment, a “tunnel hub” is deployed in the public domain and “tunnel gateways” are deployed behind the firewalls where the clients request two-way services and the servers provide two-way services. Each tunnel gateway initiates a secure tunnel out through the firewall to the target hub. Thereafter, a request for service enters the tunnel gateway, travels to the tunnel hub and to the appropriate tunnel gateway where the server is that provides the service. When the server provides the service, it enters the tunnel gateway, travels to the tunnel hub and to the appropriate tunnel gateway where the client is that requested the service.

Abstract: A method and apparatus are disclosed that enable a user who forgets one of his two passwords to securely recover the forgotten password. After a user logs in using one of his two passwords, the illustrative embodiment reveals the other password to the user. The passwords are stored in a persistent table in both hashed and encrypted forms, but not in their original forms. The illustrative embodiment is advantageous over the prior art, where forgotten passwords are reset to a default value, in two ways. First, it avoids the inconvenience of a user having to log in using the default password, think up a new string that would make a good password, and change the password from the default to the new string. Second, it avoids the use of default-value passwords that might compromise security.

Abstract: A computer network is made more secure from attack attacks by partitioning the network into sub-networks and placing firedoors in association with the links that connect each sub-network to areas outside the sub-network. The firedoors scan traffic that flows through these links to identify—based on pre-stored pattern information—whether the traffic contains a virus, or some other attack, and blocks it from leaving the sub-network. The firedoors are coupled to a firedoor keeper, through which a firedoor informs the firedoor keeper whenever it detects unusual activity that suggests a successful virus breach of the protection intended for the gateway's network and, conversely, the firedoor keeper updates a pre-stored patterns file in all of the firedoors, or directs the firedoors to take specific action, e.g., blocking all traffic, whenever the firedoor keeper deemed it necessary.